chenhg5/cc-connect · error

auth.json missing tokens.access_token

Error message

auth.json missing tokens.access_token

What it means

readOAuthTokens validates that the parsed auth.json contains a non-empty tokens.access_token. This error is thrown when the JSON parses fine but the access_token field is absent, empty, or whitespace-only. Without an access token the usage endpoint cannot be called, so the library fails fast with this explicit message.

Source

Thrown at agent/codex/usage.go:81

	if err != nil {
		return codexOAuthTokens{}, err
	}
	data, err := readFile(path)
	if err != nil {
		return codexOAuthTokens{}, fmt.Errorf("read %s: %w", path, err)
	}

	var payload struct {
		Tokens struct {
			AccessToken string `json:"access_token"`
			AccountID   string `json:"account_id"`
		} `json:"tokens"`
	}
	if err := json.Unmarshal(data, &payload); err != nil {
		return codexOAuthTokens{}, fmt.Errorf("parse auth.json: %w", err)
	}
	if strings.TrimSpace(payload.Tokens.AccessToken) == "" {
		return codexOAuthTokens{}, fmt.Errorf("auth.json missing tokens.access_token")
	}
	if strings.TrimSpace(payload.Tokens.AccountID) == "" {
		return codexOAuthTokens{}, fmt.Errorf("auth.json missing tokens.account_id")
	}

	return codexOAuthTokens{
		AccessToken: payload.Tokens.AccessToken,
		AccountID:   payload.Tokens.AccountID,
	}, nil
}

func (a *Agent) fetchUsage(ctx context.Context, client *http.Client, tokens codexOAuthTokens) (*core.UsageReport, error) {
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, codexUsageURL, nil)
	if err != nil {
		return nil, err
	}
	req.Header.Set("Authorization", "Bearer "+tokens.AccessToken)
	req.Header.Set("ChatGPT-Account-Id", tokens.AccountID)

View on GitHub (pinned to 4000b2338a)

Solutions

1. Run `codex login` again to obtain a fresh access token
2. Inspect auth.json and confirm tokens.access_token is present and non-empty
3. If auth.json was hand-copied, copy the complete file from a properly logged-in machine
4. Check whether a logout/credential-cleanup job wiped the token and re-authenticate

Example fix

// before: assumes token exists
usage, err := agent.GetUsage(ctx)
// after: verify the field before calling
var a struct{ Tokens struct{ AccessToken string `json:"access_token"` } `json:"tokens"` }
if json.Unmarshal(authBytes, &a) == nil && strings.TrimSpace(a.Tokens.AccessToken) == "" {
    log.Fatal("auth.json lacks tokens.access_token; run `codex login`")
}
usage, err := agent.GetUsage(ctx)

var a struct{ Tokens struct{ AccessToken string `json:"access_token"` } `json:"tokens"` }
json.Unmarshal(b, &a)
if strings.TrimSpace(a.Tokens.AccessToken) == "" { return errors.New("missing tokens.access_token; run `codex login`") }

if _, err := agent.GetUsage(ctx); err != nil && strings.Contains(err.Error(), "missing tokens.access_token") {
    log.Println("Codex token missing — trigger `codex login` re-auth")
}

When it happens

Trigger: json.Unmarshal succeeds but strings.TrimSpace(payload.Tokens.AccessToken) == "" — auth.json has a tokens object without access_token, or with ""/null. Detected by TestReadOAuthTokens_MissingFields and surfaced via GetUsage.

Common situations: Partially completed Codex login (tokens object written before access token stored); hand-crafted or copy-pasted auth.json missing the field; Codex CLI version change that altered the auth.json schema; token cleared by a logout that left an empty structure.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• auth.json missing tokens.account_id
• read %s: %w
• parse auth.json: %w
• antigravity: invalid permission behavior %q
• request usage endpoint: %w

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/fccff57b34017de0. Report an issue: GitHub.